Skip to main content

LDAP with ASP.Net Identity Core in MVC with project.json

Lightweight Directory Access Protocol (LDAP), the name itself explain it. An application protocol used over an IP network to access the distributed directory information service.

The first and foremost thing is to add references for consuming LDAP. This has to be done by adding reference from Global Assembly Cache (GAC) into project.json

 "frameworks": {  
  "net461": {  
   "frameworkAssemblies": {  
    "System.DirectoryServices": "4.0.0.0",  
    "System.DirectoryServices.AccountManagement": "4.0.0.0"  
   }  
  }  
 },  

These System.DirectoryServices and System.DirectoryServices.AccountManagement references are used to consume LDAP functionality.

It is always better to have an abstraction for irrelevant items in consuming part. For an example, the application does not need to know about PrincipalContext or any other dependent items from those two references to make it extensible. So, we can begin with some basic interface implementation which suits us.

 public interface IActiveDirectory<TUser>  
   where TUser : IdentityUser  
 {  
   /// <summary>  
   /// Finds the user by identity asynchronously.  
   /// </summary>  
   /// <param name="userId">The user id.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>User information.</returns>  
   Task<TUser> FindByIdentityAsync(string userId, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Gets the user roles asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>Roles for the user.</returns>  
   IList<string> GetUserRolesAsyc(string username, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="identity">The identity.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns><c>true</c>if user is authenticated;<c>false</c>for unauthorized user.</returns>  
   Task<bool> IsAuthenticatedAsync(IIdentity identity, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="password">The password.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns><c>true</c>if user is authenticated;<c>false</c>for unauthorized user.</returns>  
   Task<bool> IsAuthenticatedAsync(string username, string password, CancellationToken cancellationToken = default(CancellationToken));  
   /// <summary>  
   /// Gets Authenticated user claim asynchronous.  
   /// </summary>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>Authenticated user claims.</returns>  
   Task<ClaimsIdentity> AuthenticatedUserClaimAsync(CancellationToken cancellationToken = default(CancellationToken));  
 }  

It is just the basic structure, but can be modified based on need.

With this structure, we need to have a proper definition for each item and in that, we would using the added references.

 public sealed class ActiveDirectoryLdap  
   : IActiveDirectory<User>, IDisposable  // TODO: Actual model 

 {  
   //  
   /// <summary>  
   /// The principal context  
   /// </summary>  
   private readonly PrincipalContext PrincipalContext;  
   /// <summary>  
   /// Initializes a new instance of the <see cref="ActiveDirectoryLdap"/> class.  
   /// </summary>  
   /// <param name="principalContext">The principal context.</param>  
   public ActiveDirectoryLdap(PrincipalContext principalContext)  
   {  
     PrincipalContext = principalContext;  
   }  
   /// <summary>  
   /// Gets Authenticated user claim asynchronous.  
   /// </summary>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   /// Authenticated user claims.  
   /// </returns>  
   public Task<ClaimsIdentity> AuthenticatedUserClaimAsync(CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var user = UserPrincipal.Current;  
     if (user != null)  
     {  
       using (var adUser = UserPrincipal.FindByIdentity(PrincipalContext, user.Name))  
       {  
         if (adUser != null)  
         {  
           return Task.FromResult(CreateClaims(adUser));  
         }  
       }  
     }  
     return Task.FromResult(new ClaimsIdentity());  
   }  
   /// <summary>  
   /// Creates the claims as Active Directory User.  
   /// </summary>  
   /// <param name="user">The user.</param>  
   /// <returns>Claims for user.</returns>  
   private ClaimsIdentity CreateClaims(UserPrincipal user)  
   {  
     var identity = new ClaimsIdentity();  
     if (user != null)  
     {  
       identity.AddClaims(new[]  
       {  
         new Claim(ClaimTypes.Name, user.Name),  
         new Claim(ClaimTypes.Email, user.EmailAddress),  
         new Claim(ClaimTypes.NameIdentifier, user.Name),  
         new Claim(ClaimTypes.Name, user.DisplayName),  
         new Claim(ClaimTypes.GivenName, user.GivenName)  
       });  
     }  
     return identity;  
   }  
   /// <summary>  
   /// Finds the user by identity asynchronously.  
   /// </summary>  
   /// <param name="userId">The user id.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   /// User information.  
   /// </returns>  
   public Task<User> FindByIdentityAsync(string userId,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var directoryUser = UserPrincipal.FindByIdentity(PrincipalContext, userId);  
     if (directoryUser != null)  
     {  
       return Task.FromResult(new User 
       {  
         //Id = userId,  
         UserName = userId,  
         Email = directoryUser.EmailAddress,  
         //FirstName = directoryUser.GivenName,  
         //LastName = directoryUser.Surname,  
         //DisplayName = directoryUser.Name  
       });  
     }  
     return Task.FromResult<User>(null);  
   }  
   /// <summary>  
   /// Gets the user roles asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   /// Roles for the user.  
   /// </returns>  
   public IList<string> GetUserRolesAsyc(string username,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var rols = new List<string>();  
     if (IsUserInGroup(username, "viewer"))  
     {  
       rols.Add("viewer");  
     }  
     if (IsUserInGroup(username, "admin"))  
     {  
       rols.Add("admin");  
     }  
     return rols;  
   }  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="identity">The identity.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   ///  <c>true</c>if user is authenticated;<c>false</c>for unauthorized user.  
   /// </returns>  
   public Task<bool> IsAuthenticatedAsync(IIdentity identity,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     var userPrincipal = UserPrincipal.FindByIdentity(PrincipalContext,  
                         IdentityType.SamAccountName,  
                         identity.Name);  
     return Task.FromResult(userPrincipal != null);  
   }  
   /// <summary>  
   /// Determines whether user is authenticated asynchronously.  
   /// </summary>  
   /// <param name="username">The username.</param>  
   /// <param name="password">The password.</param>  
   /// <param name="cancellationToken">The cancellation token.</param>  
   /// <returns>  
   ///  <c>true</c>if user is authenticated;<c>false</c>for unauthorized user.  
   /// </returns>  
   public Task<bool> IsAuthenticatedAsync(string username, string password,  
     CancellationToken cancellationToken = default(CancellationToken))  
   {  
     return Task.FromResult(PrincipalContext.ValidateCredentials(username, password));  
   }  
   /// <summary>  
   /// Determines whether specified user is in group.  
   /// </summary>  
   /// <param name="user">The user.</param>  
   /// <param name="group">The group.</param>  
   /// <returns><c>true</c>if user is in group;<c>false</c>for not in a group.</returns>  
   private bool IsUserInGroup(string user, string group)  
   {  
     bool found = false;  
     try  
     {  
       var gropPrincipal = GroupPrincipal.FindByIdentity(PrincipalContext, group);  
       var userPrincipal = UserPrincipal.FindByIdentity(PrincipalContext, IdentityType.SamAccountName, user);  
       if (gropPrincipal != null)  
       {  
         found = gropPrincipal.GetMembers(true)  
           .Contains(userPrincipal);  
       }  
     }  
     catch (Exception)  
     {  
       found = false;  
     }  
     return found;  
   }  
   #region " IDisposable "  
   /// <summary>  
   /// Disposed  
   /// </summary>  
   private bool disposed = false;  
   /// <summary>  
   /// Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.  
   /// </summary>  
   public void Dispose()  
   {  
     Dispose(true);  
     GC.SuppressFinalize(this);  
   }  
   /// <summary>  
   /// Releases unmanaged and - optionally - managed resources  
   /// </summary>  
   /// <param name="disposing"><c>true</c> to release both managed and unmanaged resources.</param>  
   private void Dispose(bool disposing)  
   {  
     if (!disposed)  
     {  
       if (disposing)  
       {  
         PrincipalContext.Dispose();  
       }  
     }  
     this.disposed = true;  
   }  
   #endregion " IDisposable "  


Ideally, whenever a user visits they should be automatically allowed to log in. So for that, we would be customizing UserManager to create our own function and call on the login page.

 public class MyProjectUserManager  
   : UserManager<User>  
 {  
   /// <summary>  
   ///   The active directory  
   /// </summary>  
   private readonly IActiveDirectory<User> ActiveDirectory;  
   /// <summary>  
   ///   Gets a flag indicating whether the Active Directory is supported.  
   /// </summary>  
   public readonly bool SupportsActiveDirectory;  
   /// <summary>  
   ///   Initializes a new instance of the <see cref="MyProjectUserManager" /> class.  
   /// </summary>  
   /// <param name="store">The store.</param>  
   /// <param name="optionsAccessor">The options accessor.</param>  
   /// <param name="passwordHasher">The password hasher.</param>  
   /// <param name="userValidators">The user validators.</param>  
   /// <param name="passwordValidators">The password validators.</param>  
   /// <param name="keyNormalizer">The key normalizer.</param>  
   /// <param name="errors">The errors.</param>  
   /// <param name="services">The services.</param>  
   /// <param name="logger">The logger.</param>  
   /// <param name="activeDirectory">The active directory.</param>  
   public MyProjectUserManager(IUserStore<User> store, IOptions<IdentityOptions> optionsAccessor,  
     IPasswordHasher<User> passwordHasher, IEnumerable<IUserValidator<User>> userValidators,  
     IEnumerable<IPasswordValidator<User>> passwordValidators, ILookupNormalizer keyNormalizer,  
     IdentityErrorDescriber errors, IServiceProvider services, ILogger<UserManager<User>> logger,  
     IActiveDirectory<User> activeDirectory)  
     : base(store, optionsAccessor, passwordHasher, userValidators, passwordValidators, keyNormalizer,  
       errors, services, logger)  
   {  
     ActiveDirectory = activeDirectory;  
     SupportsActiveDirectory = activeDirectory != null;  
   }  
   /// <summary>  
   ///   Gets the Active Directory user claims.  
   /// </summary>  
   /// <returns></returns>  
   private async Task<ClaimsIdentity> GetAdUserClaims()  
   {  
     if (SupportsActiveDirectory)  
     {  
       return await ActiveDirectory.AuthenticatedUserClaimAsync();  
     }  
     var identity = new ClaimsIdentity();  
     return await Task.FromResult(identity);  
   }  
   /// <summary>  
   ///   Gets or create Active Directory user entry and returns same.  
   /// </summary>  
   /// <returns></returns>  
   public async Task<User> GetOrCreateAdUser()  
   {  
     var adUserClaim = await GetAdUserClaims();  
     //if (adUserClaim.IsAuthenticated && adUserClaim.Claims.Any())  
     if (adUserClaim.Claims.Any())  
     {  
       var availableUser = await FindByNameAsync(adUserClaim.Name);  
       if (availableUser != null)  
       {  
         return await Task.FromResult(availableUser);  
       }  
       var usr = new User  
       {  
         UserName = adUserClaim.FindFirst(c => c.Type == ClaimTypes.NameIdentifier).Value,  
         Email = adUserClaim.FindFirst(c => c.Type == ClaimTypes.Email).Value  
       };  
       var result = await CreateAsync(usr);  
       if (result.Succeeded)  
       {  
         var claimsRes = await AddClaimsAsync(usr, adUserClaim.Claims);  
         if (claimsRes.Succeeded)  
         {  
           return await Task.FromResult(usr);  
         }  
       }  
     }  
     return await Task.FromResult(default(User));  
   }  
 }  

The function GetOrCreateAdUser needs to be called on Login Get Action. This would create an entry into AspNet Identity Core. Please mark that it is being used to create a direct user in AspNet Identity without providing a password. It can be also customized to allow as external login.

The Get request for Login action.

 [HttpGet]  
 [AllowAnonymous]  
 public Task<IActionResult> Login(string returnUrl = null)  
 {  
   var adUser = await UserManager.GetOrCreateAdUser();  
   if (adUser != null)  
   {  
     //SignInManager.ExternalLoginSignInAsync()  
     await SignInManager.SignInAsync(adUser, false, CookieAuthenticationDefaults.AuthenticationScheme);  
     return RedirectToLocal(returnUrl);  
   }  
   ViewData["ReturnUrl"] = returnUrl;  
   return View();  
 }  

That is all we need to do, the final part is to setup dependency injection for IActiveDirectory under Startup.cs.

 services.AddScoped<IActiveDirectory<User>>(provider =>  
 {  
   try  
   {  
     var adServerPath = Configuration.GetSection("AppSettings").Get<string>("LdapUrl"); // From configuration  
     return new ActiveDirectoryLdap(new PrincipalContext(ContextType.Domain, adServerPath));  
   }  
   catch (PrincipalServerDownException) // Avoid LDAP if not available.  
   {  
   }  
 });  



Popular posts from this blog

Architecture solution composting Repository Pattern, Unit Of Work, Dependency Injection, Factory Pattern and others

Project architecture is like garden, we plant the things in certain order and eventually they grow in similar manner. If things are planted well then they will all look(work) great and easier to manage. If they grow as cumbersome it would difficult to maintain and with time more problems would be happening in maintenance.

There is no any fixed or known approach to decide project architecture and specially with Agile Methodology. In Agile Methodology, we cannot predict how our end products will look like similarly we cannot say a certain architecture will fit well for entire development lifespan for project. So, the best thing is to modify the architecture as per our application growth. I understand that it sounds good but will be far more problematic with actual development. If it is left as it is then more problems will arise with time. Just think about moving plant vs a full grown tree.

Coming to technical side, In this article, I will be explaining about the various techniques tha…

Configuring Ninject, Asp.Net Identity UserManager, DataProtectorTokenProvider with Owin

It can be bit tricky to configure both Ninject and Asp.Net Identity UserManager if some value is expected from DI to configure UserManager. We will look into configuring both and also use OwinContext to get UserManager.

As usual, all configuration need to be done on Startup.cs. It is just a convention but can be used with different name, the important thing is to decorate class with following attribute to make it Owin start-up:

[assembly: OwinStartup(typeof(MyProject.Web.Startup))]
Ninject configuration

Configuring Ninject kernel through method which would be used to register under Owin.

Startup.cs
public IKernel CreateKernel() { var kernel = new StandardKernel(); try { //kernel.Bind<IHttpModule>().To<HttpApplicationInitializationHttpModule>(); // TODO: Put any other injection which are required. return kernel; } catch { kernel.Dispose(); throw; }…